A critical vulnerability in the PHP programming language has led to the shutdown of major websites and web services worldwide, including 32 UK government services that are currently unavailable and four that are partially unavailable, according to Baroness Lloyd of Effra in the House of Lords on Thursday morning. However, No.10 Downing Street confirmed that no large UK public-facing critical services have been affected.
Flaw Discovered With AI Assistance
The weakness in PHP, the scripting language that underpins sites such as Wikipedia and WordPress, was exposed after security researchers used OpenAI technology to investigate its inner workings. The flaw could enable potential attackers to seize control of affected web servers.
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), told BBC Radio 4's Today programme that both the scale and nature of the vulnerability are alarming. "We're talking something like 30 million websites out there – we're certainly getting off of that number – but also the nature of it," he said.
"It's not just the vast volume of websites that use it, but this is called a remote code execution vulnerability, and what that means is an attacker can get their own code onto the web server and run it, and basically do whatever they like," Woodward added. "They can steal data, they can go to other parts of your network, all sorts of things like that. Even plant the backdoor to get in later on, so you can see, pretty serious."
Patches Issued for PHP Versions
The PHP Foundation identified two Common Vulnerabilities and Exposures (CVEs), CVE-2026-109618 and CVE-2026-109619. The flaws affect "all PHP installations serving web requests" and can be traced back to PHP version 5, first released in 2004.
PHP 8.2 and newer versions, which remain supported by the foundation, will receive patches. In an alert published on Wednesday, the foundation cautioned: "There are no complete mitigations, updating is the only safe choice."
Since the weaknesses were uncovered, "millions" of attempts to exploit PHP-based sites have been recorded, targeting government and business platforms globally. In the UK, the official websites of the Office for Budget Responsibility (OBR), Oxfordshire County Council and Hillingdon Council were among those compelled to shut down and update their systems.
Exploitation Attempts Surge
Matthew Prince, chief executive of internet services firm Cloudflare, wrote on X that sites were targeted approximately 10 hours before the vulnerability was publicly disclosed. "In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," he said. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now."
Lukasz Olejnik, a visiting senior research fellow at King's College London, told Wired magazine: "This is not a drill." He added: "The impact is enormous. Especially if attackers would turn to exploiting these vulnerabilities fast. Worst case is wormable malware affecting big chunks of the internet."
Chris Dimitriadis, Chief Global Strategy Officer at ISACA, warned that vulnerabilities can trigger consequences "across borders and industries within hours". He said: "A single vulnerability can trigger a global domino effect across borders and industries within hours. What we're seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI."
Government Response and Budget Security
A Government spokesperson confirmed that efforts were already under way to "identify and patch any potential exposure". They added: "We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
The Government has further confirmed that the integrity of next week's Budget has not been compromised by the critical security flaw. Scotland Secretary Douglas Alexander, questioned over whether the vulnerabilities could trigger significant leaks given that the OBR had taken its website offline, told Times Radio: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security."
Alexander added: "Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer." Last year, the OBR's Budget analysis was accidentally published online ahead of then-chancellor Rachel Reeves' statement to the Commons, providing early access to market-sensitive information.
